CVE-2022-41703

Опубликовано: 16 янв. 2023

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Ссылки

https://lists.apache.org/thread/g7jjw0okxjk5y57pbbxy19ydw42kqcos
Mailing List
Third Party Advisory
https://lists.apache.org/thread/g7jjw0okxjk5y57pbbxy19ydw42kqcos
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*

Версия до 1.5.2 (включая)

cpe:2.3:a:apache:superset:2.0.0:-:*:*:*:*:*:*

cpe:2.3:a:apache:superset:2.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:superset:2.0.0:rc2:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01302

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-89

Связанные уязвимости

GHSA-cxvp-3frm-3876